A computer network is a collection of interconnected devices that can exchange data and share resources according to one or more communication protocols. The communication protocols define the format and manner in which the devices communicate the data. Example protocols include the Transmission Control Protocol (TCP) and the Internet Protocol (IP) that facilitate data communication by dividing the data into small blocks called packets. These packets are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission. The protocols define the format and construction of the packet, including header and payload portions of the packets.
Periodically, it is necessary to transition from one communication protocol to another. This may occur, for example, when a current communication protocol used within a network is upgraded to a newer version. As one example, the Internet is currently based on a communication protocol known as Internet Protocol version 4 (IPv4). IPv4 offers a ubiquitous network service, based on datagram (connectionless) operation, and on globally significant IP addresses to aid routing. It is becoming clear that certain elements of IPv4 are insufficient to support the growth of the Internet. For example, IPv4 makes use of a 32-bit address space. Internet Protocol version 6 (IPv6), however, makes use of a much larger 128-bit address space. However, development, standardization, implementation, testing, debugging and deployment of a new communication protocol can take a very large amount of time and energy, and is not guaranteed to lead to success.
A variety of approaches may be used in an attempt to provide a smooth transition from one communication protocol to another. One example approach that has been proposed is known as “dual-stack lite,” as described in “Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion” to A. Durand et al., Internet Engineering Task Force (IETF) RFC 6333, August 2011, the entire content of which is herein incorporated by reference. According to this approach, a residential gateway (also referred to herein as “customer premise equipment”) located at a subscriber's premises acts as an ingress and egress for a tunnel that encapsulates IPv4 packets within IPv6 packets. These IPv4-over-IPv6 tunnels are commonly referred to as “softwires.” The residential gateway forwards the IPv6 packets towards a router within a service provider network that decapsulates the IPv4 packets from the IPv6 packets. The router operates as an address family translation router (AFTR) and applies a network address translation (NAT) rule to each IPv4 packet, and forwards the IPv4 packets to the Internet. In the DS-Lite architecture, global IPv4 addresses are shared among subscribers in the AFTR, acting as a Carrier-Grade NAT (CGN) device. In this way, DS-Lite enables unmodified IPv4 application to access the IPv4 Internet over the IPv6 access network.
Service providers are often required to be able to identify a particular customer that is associated with particular network traffic. For example, service provides are typically required to maintain information such that any give network address that sourced or received certain traffic can be traced back to the particular customer. As a result, service providers typically maintain archives of NAT system log files (“syslog”). Each syslog file stores potentially a significant amount of information including the private source IP address, the private source port, any VPN information of the subscriber, tunneling information, any NAT rules/terms, public IP address and port assigned to the subscriber, and the like.
The service providers are typically required to store this information for months or years to meet law enforcement requirements. This can present significant challenges and burdens in certain environments, such as large service provider networks where session setup rate is typically very high with tens of thousands of sessions being established and torn down each day. Generating syslogs with NAT translation information in such an environment for each and every session during the setup and teardown consumes resources on the NAT device, network bandwidth and also resources on the servers storing the syslogs.